Cross-site scripting in Roundcube Webmail - CVE-2026-26079

Vulnerability identifier: #VU122450

CSH Severity: Medium

CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]

CVE-ID: CVE-2026-26079

CWE-ID: CWE-79

Exploitation vector: Remote access

Exploit availability: No public exploit available

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data when handling CSS files. A remote attacker can send a specially crafted email messages and perform CSS injection attacks.

Roundcube Webmail
Debian Linux
Fedora
Ubuntu
roundcube (Ubuntu package)
roundcubemail
roundcube (Debian package)

Install updates from vendor's website.

Roundcube Webmail - addressed in versions 1.5.13, 1.6.13
roundcube (Ubuntu package) - addressed in versions 1.2~beta+dfsg.1-0ubuntu1+esm8, 1.3.6+dfsg.1-1ubuntu0.1~esm8, 1.4.3+dfsg.1-1ubuntu0.1~esm8, 1.5.0+dfsg.1-2ubuntu0.1~esm6, 1.6.6+dfsg-2ubuntu0.1+esm3
roundcubemail - addressed in versions 1.5.13-1.el9, 1.6.13-1.el10_1, 1.6.13-1.el10_2, 1.6.13-1.fc42, 1.6.13-1.fc43
roundcube (Debian package) - addressed in versions 1.6.5+dfsg-1+deb12u7, 1.6.13+dfsg-0+deb13u1

• https://roundcube.net/news/2026/02/08/security-updates-1.6.13-and-1.5.13

• Multiple vulnerabilities in Roundcube Webmail
• Fedora EPEL 9 update for roundcubemail
• Fedora 42 update for roundcubemail
• Fedora EPEL 10.1 update for roundcubemail
• Fedora EPEL 10.2 update for roundcubemail
• Fedora 43 update for roundcubemail
• Debian update for roundcube
• Ubuntu update for roundcube